Newsletter (96)

The CLOUD Act, or the American Clarifying Lawful Overseas Use of Data Act, is a United States’ (U.S.) federal law that came into force in March 2018. Amending the U.S. Stored Communications Act (SCA), the CLOUD Act allows the U.S. government, with a court order, to access electronically stored communication data located in a private entity subject to U.S law but located outside the U.S., providing that this data is relevant to an ongoing criminal investigation. The CLOUD Act also allows for bilateral agreements to be concluded between the U.S and another country, such as a country in the EU or European Economic Area, to exchange personal data or to have access to each country’s respective data for law enforcement purposes.

Concretely, entities in the EU, including EU institutions, bodies, offices and agencies, could be subject to the U.S. Cloud Act if they use services, such as web services, that have a link with the U.S or are based in the U.S. for example. Any direct or indirect corporate link between an EU entity and a U.S. entity could be subject to the CLOUD Act. It is equally important that the controllers, joint-controllers, processors and joint processors in charge of deciding how and for what purposes personal data may be processed do not have corporate links with U.S companies either.

Other, but perhaps less obvious, ways in which EU entities could be subject to the CLOUD Act are:

• the EU entity in question actively targets U.S. consumers through specific advertising or by creating a dedicated website, providing tailored services to appeal to U.S customers;
• the EU entity in question does not specifically target U.S. consumers but nevertheless has U.S customers, which generates revenue and provides insight into U.S. consumers’ behaviour.

On the contrary, the following circumstances do not necessarily mean that the EU entity in question would be subject to the CLOUD Act:

• if the EU entity actively avoids targeting U.S. consumers by blocking access to its website for example, but has contacts with U.S. consumers;
• if a third party uses or sells an EU entity’s products and services in the U.S., but the EU entity itself does not target U.S. consumers.

These developments reconfirm the importance of seeking alternative services, such as cloud and web services, based in the EU, to ensure that individuals’ personal data is processed according to EU data protection law and EU values.

On 11 August 2022, the EDPS issued an Opinion on a proposed Regulation for a Farm Sustainability Data Network (FSDN).

The FSDN aims to expand the scope of the Farm Accountancy Data Network (FADN), a public database that collates annually aggregated data from crop and livestock farms to assess the economy of farms and rural areas within the EU Member States and at EU level. In addition to the data already collected in the FADN, the Farm Sustainability Data Network (FSDN) would include environmental data linked to soil, air, water and biodiversity, as well as data related to the social dimension of farming. Data collected and encoded into the FSDN may include the identity, address, location of farmers and farms; this information amounts to personal data.

The data collected in the FSDN would serve as a basis for the European Commission and relevant Agencies to draft reports that would contribute to the EU’s Common Agricultural Policy, the Green Deal, and other existing or future initiatives concerning agriculture, farming and sustainability. It is also planned that this data may be used to provide personalised advice, advisory services and feedback to farmers to improve their sustainability.

In this regard, the EDPS welcomes that this data, shared with and between the European Commission and relevant Agencies, would be anonymised or pseudonymised, highlighting that these are important techniques to mitigate data protection risks for individuals. Nevertheless, the EDPS points out, in its Opinion, that anonymisation and pseudonymisation are two different techniques. While the process of anonymising data means that this data cannot be related to an identified or identifiable individual, the process of pseudomynising data means that this data could be reattributed to a specific individual with the use of additional information. Therefore, pseudonymised data would be considered as personal data. Taking into account these meaningful differences that may impact the secure way in which personal data is processed, the EDPS recommends that the proposed Regulation clarifies how, and in what form, this data may be exchanged, with the aim of prioritising the protection of farmers’ personal data and privacy. 

Similarly to the FADN, data included in the Farm Sustainability Data Network (FSDN) is to be made publically available, according to its proposed Regulation. The EDPS underscores that rendering the data included in the FSDN public strictly depends on whether this data would serve the objective of public interest, and on whether making this data public is necessary and proportionate in light of the objectives of this proposed Regulation. Taking into account these mandatory criteria, the EDPS indicates in its Opinion that sharing FSDN data publically for the objective of transparency or for the objective of contributing to the assessment of the EU’s agriculture policy are not considered as objectives of public interest that would justify the publication of this data.

As a general remark, the EDPS recommends that the types of personal data, the way this data is processed, such as the technical tools and other safeguards used for its processing, as well as the roles and responsibilities of those processing this data are specifically addressed in the proposed Regulation for a Farm and Sustainability Network (FSDN).

Read the EDPS Opinion on the Farm and Sustainability Network.

What is an EDPS Opinion? Find out here.

On 29 July, the European Data Protection Supervisor (EDPS) and the European Data Protection Board (EDPB) adopted a Joint Opinion on the Proposal for a Regulation to prevent and combat child sexual abuse. The Proposal aims to impose obligations related to detecting, reporting, removing and blocking known and new online child sexual abuse material (CSAM), as well as the solicitation of children, on providers of hosting services, interpersonal communication services, software application stores, internet access services and other relevant services.

The EDPB and EDPS consider child sexual abuse as a particularly serious and heinous crime. Limitations to the rights to private life and data protection must, however, respect the essence of these fundamental rights and remain limited to what is strictly necessary and proportionate. The EDPB and EDPS consider that the Proposal, in its current form, may present more risks to individuals, and, by extension, to society at large, than to the criminals pursued for CSAM. Whilst supporting the goals and intentions behind the Proposal, the EDPS and EDPB express serious concerns about the impact of the envisaged measures on individuals’ privacy and personal data. The lack of detail, clarity and precision of the conditions for issuing a detection order for CSAM and child solicitation does not ensure that only a targeted approach to CSAM detection will effectively take place. There is a risk that the Proposal could become the basis for a generalised and indiscriminate scanning of content of virtually all types of electronic communications. The EDPB and EDPS advise that the conditions for issuing a detection order should be further clarified.

Continue Reading EDPS-EDPB Press Release

Read EDPS -EDPB Opinion

What is Artificial Intelligence (AI)? Well, it is a complex concept, hard to define, challenging to understand, but what is sure is that it is seeping into our everyday lives, and growing exponentially. 

The multi-layered complexity of AI is perhaps what sparked curiosity amongst the European Data Protection Supervisor (EDPS) and European Data Protection Board (EDPB) trainees of February to July 2022, and the reason why they decided to produce a three-part podcast series on this topic. Episodes are available on the EDPS website here.

The EDPS and EDPB trainees gathered a variety of experts from law, academia, data protection and from the tech industry to help define AI, how it works, how AI should be regulated, its opportunities, but also its impact on individuals’ fundamental rights to privacy and personal data.

AI-based technologies have the potential to alter society’s way of living, both in a positive and negative way. AI can provide solutions in different areas, such as in the health or education sector. AI can also be a tool to help make decisions, even the most important ones, more efficiently. This is particularly relevant in employment by sifting automatically through candidates’ job applications, or interrogating databases to combat or prevent crime, as well as for purposes of automated-decision making in the context of border control management, to name a few examples.

But, the use of AI also means the processing of huge volumes of data: individuals’ data, our data. This comes with risks that must be mitigated with appropriate laws, technological safeguards, and collaboration within the EU and beyond, to help shape AI now and in the future in a way that protects individuals, their fundamental rights, their privacy.

Listen to the podcast to hear experts share their views on AI and AI-based technologies, and learn about concrete solutions to make AI privacy compliant.

Listen to Episode 1

Listen to Episode 2

Listen to Episode 3

Read Blogpost written by the EDPS and the EDPB trainees

Apply for a Blue Book Traineeship and select the EDPS or the EDPB as your first choice

The EDPS issued on 7 June 2022 two Supervisory Opinions regarding Frontex, the European Border and Coast Guard Agency contributing to the effective management of European borders.

Supervisory Opinions are either issued on the EDPS’ own-initiative or at the request of an EU institution, body, office or agency (EUI) on various data protection matters, typically on how an EUI processes individuals’ personal data in its day-to-day work.

The first Supervisory Opinion concerns Frontex’s Internal Rules applicable to all of its personal data processing activities. Whilst the second Supervisory Opinion concerns Frontex’s personal data processing activities related to the identification of suspects involved in cross-border crimes.

In both Supervisory Opinions, the EDPS remarks that Frontex’s Internal Rules are not sufficiently clear, and, therefore, recommends that the following aspects are clarified:

• the purposes for which individuals’ personal data may be processed;
• the categories of individuals that may have their personal data processed;
• the categories of personal data that may be processed;
• information on controllers or categories of controllers who may process individuals’ personal data;
• data protection safeguards to prevent abusive or unlawful access to individuals’ personal data;
• the time period during which individuals’ personal data will be stored.

Clarifying the aforementioned aspects is a requirement stemming from the EU Charter of Fundamental Rights, to ensure that individuals’ rights to privacy and personal data protection are protected at all times.

Specifically in its second Supervisory Opinion, the EDPS notes that several internal rules seem to expand Frontex’s role and scope as a law enforcement authority. According to the Treaty on the Functioning of the EU, Frontex’s role is to ensure the management of European borders, specifically in the areas of border checks, asylum and migration, and is not responsible for preventing and combatting serious crimes, for which another EU agency is in charge of, highlights the EDPS. Therefore, any activities related to preventing and combatting serious forms of crime should be considered as a secondary action as a way of supporting the EU Agency in charge of such tasks. These differentiations should be accurately reflected in Frontex’s external rules, writes the EDPS.

The EDPS  recalls that special categories of personal data, such as individuals’ health data, data revealing racial or ethnic origin, genetic data, can only be processed if this can be legally justified. These special categories of data also need to be protected with specific safeguards to avoid discriminatory practices.

Read the Supervisory Opinion on Frontex 1

Read the Supervisory Opinion on Frontex 2

Click here for all of our Supervisory Opinions